Secure discovery boot data with jwt signed tokens

cmd/main.go

@@ -44,6 +44,7 @@ import (
 	"github.com/ironcore-dev/metal-operator/internal/controller"
 	metalmetrics "github.com/ironcore-dev/metal-operator/internal/metrics"
 	"github.com/ironcore-dev/metal-operator/internal/registry"
+	metaltoken "github.com/ironcore-dev/metal-operator/internal/token"
 	// +kubebuilder:scaffold:imports
 )
 
@@ -98,6 +99,7 @@ func main() { // nolint: gocyclo
 		resourcePollingInterval            time.Duration
 		resourcePollingTimeout             time.Duration
 		discoveryTimeout                   time.Duration
+		discoveryTokenExpiry               time.Duration
 		biosSettingsApplyTimeout           time.Duration
 		bmcFailureResetDelay               time.Duration
 		bmcResetResyncInterval             time.Duration
@@ -113,6 +115,8 @@ func main() { // nolint: gocyclo
 	flag.IntVar(&serverClaimMaxConcurrentReconciles, "server-claim-max-concurrent-reconciles", 5,
 		"The maximum number of concurrent ServerClaim reconciles.")
 	flag.DurationVar(&discoveryTimeout, "discovery-timeout", 30*time.Minute, "Timeout for discovery boot")
+	flag.DurationVar(&discoveryTokenExpiry, "discovery-token-expiry", 1*time.Hour,
+		"Validity duration of signed discovery tokens issued to servers")
 	flag.DurationVar(&resourcePollingInterval, "resource-polling-interval", 5*time.Second,
 		"Interval between polling resources")
 	flag.DurationVar(&resourcePollingTimeout, "resource-polling-timeout", 2*time.Minute, "Timeout for polling resources")
@@ -469,7 +473,8 @@ func main() { // nolint: gocyclo
 			ResourcePollingInterval: resourcePollingInterval,
 			ResourcePollingTimeout:  resourcePollingTimeout,
 		},
-		DiscoveryTimeout: discoveryTimeout,
+		DiscoveryTimeout:     discoveryTimeout,
+		DiscoveryTokenExpiry: discoveryTokenExpiry,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "Failed to create controller", "controller", "server")
 		os.Exit(1)
@@ -715,7 +720,13 @@ func main() { // nolint: gocyclo
 	// Run registry server as a runnable to ensure it stops when the manager stops
 	if err := mgr.Add(manager.RunnableFunc(func(ctx context.Context) error {
 		setupLog.Info("starting registry server", "RegistryURL", registryURL)
-		registryServer := registry.NewServer(setupLog, fmt.Sprintf(":%d", registryPort), mgr.GetClient())
+		registryServer := registry.NewServer(
+			setupLog,
+			fmt.Sprintf(":%d", registryPort),
+			mgr.GetClient(),
+			metaltoken.DiscoveryTokenSigningSecretName,
+			managerNamespace,
+		)
 		if err := registryServer.Start(ctx); err != nil {
 			return fmt.Errorf("unable to start registry server: %w", err)
 		}

cmd/metalprobe/main.go

@@ -20,13 +20,15 @@ var (
 func main() {
 	var registryURL string
 	var serverUUID string
+	var discoveryToken string
 	var duration time.Duration
 	var registryClientTimeout time.Duration
 	var LLDPSyncInterval time.Duration
 	var LLDPSyncDuration time.Duration
 
 	flag.StringVar(&registryURL, "registry-url", "", "Registry URL where the probe will register itself.")
 	flag.StringVar(&serverUUID, "server-uuid", "", "Agent UUID to register with the registry.")
+	flag.StringVar(&discoveryToken, "discovery-token", "", "Discovery token for authenticating with the registry.")
 	flag.DurationVar(&duration, "duration", 5*time.Second, "Duration of time to wait between checks.")
 	flag.DurationVar(&registryClientTimeout, "registry-client-timeout", 5*time.Second,
 		"Timeout for HTTP requests to the registry.")
@@ -53,11 +55,18 @@ func main() {
 		os.Exit(1)
 	}
 
+	if discoveryToken == "" {
+		setupLog.Error(nil, "discovery token is missing")
+		os.Exit(1)
+	}
+
 	ctx := ctrl.SetupSignalHandler()
 
 	setupLog.Info("starting registry agent")
-	agent := probe.NewAgent(setupLog, serverUUID, registryURL, duration, registryClientTimeout,
-		LLDPSyncInterval, LLDPSyncDuration)
+	agent := probe.NewAgent(
+		setupLog, serverUUID, registryURL, discoveryToken,
+		duration, registryClientTimeout, LLDPSyncInterval, LLDPSyncDuration,
+	)
 	if err := agent.Start(ctx); err != nil {
 		setupLog.Error(err, "problem running probe agent")
 		os.Exit(1)